802.1x with Cisco wireless controller
Hi all, I have been asked to integrate our Cisco WLC2504 wireless controller with Active Directory through LDAP. It is currently working well with Microsoft's radius server. For some reason while running radiusd -X, I can see the requests coming from the access controller but nothing happens after a "Sent Access-Challenge" message. But if I wait some time without doing anything, the authentication works. What is puzzling me is the fact that the connection sometimes works but not always, also, I got a TP-Link running OpenWRT and set up WiFi to work with the same radius setup. It works properly. Am I missing anything guys? Here are the client sections for both client cisco { ipaddr = 192.168.0.240 secret = 123456 nas_type = cisco } client openwrt { ipaddr = 192.168.0.33 secret = 123456 }
On Apr 19, 2015, at 10:38 AM, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
I have been asked to integrate our Cisco WLC2504 wireless controller with Active Directory through LDAP. It is currently working well with Microsoft's radius server.
That's expected.
For some reason while running radiusd -X, I can see the requests coming from the access controller but nothing happens after a "Sent Access-Challenge" message. But if I wait some time without doing anything, the authentication works.
Blame the AP and/or the end machine running EAP. FreeRADIUS is sending a response, and they aren't continuing the EAP conversation. I've seen this before. Honestly, I don't know what causes it. Try... fail. Try... fail. Try... succeed. Does the client have a random number generator which randomly fails authentication? It's bizarre.
What is puzzling me is the fact that the connection sometimes works but not always, also, I got a TP-Link running OpenWRT and set up WiFi to work with the same radius setup. It works properly.
Yeah. OpenWRT runs hostap for it's WiFi stack. That code works. Cisco equipment? No idea.
Am I missing anything guys?
Switch to a different AP. Alan DeKok.
Thanks a million for your reply. But I can't help but be surprised that the access controller is working well with the MS radius server. Since it doesn't, shouldn't it also work with FreeRadius? -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mshami=tagorg.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Sunday, April 19, 2015 9:53 PM To: FreeRadius users mailing list Subject: Re: 802.1x with Cisco wireless controller On Apr 19, 2015, at 10:38 AM, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
I have been asked to integrate our Cisco WLC2504 wireless controller with Active Directory through LDAP. It is currently working well with Microsoft's radius server.
That's expected.
For some reason while running radiusd -X, I can see the requests coming from the access controller but nothing happens after a "Sent Access-Challenge" message. But if I wait some time without doing anything, the authentication works.
Blame the AP and/or the end machine running EAP. FreeRADIUS is sending a response, and they aren't continuing the EAP conversation. I've seen this before. Honestly, I don't know what causes it. Try... fail. Try... fail. Try... succeed. Does the client have a random number generator which randomly fails authentication? It's bizarre.
What is puzzling me is the fact that the connection sometimes works but not always, also, I got a TP-Link running OpenWRT and set up WiFi to work with the same radius setup. It works properly.
Yeah. OpenWRT runs hostap for it's WiFi stack. That code works. Cisco equipment? No idea.
Am I missing anything guys?
Switch to a different AP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 21 Apr 2015, at 14:15, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
Thanks a million for your reply.
But I can't help but be surprised that the access controller is working well with the MS radius server. Since it doesn't, shouldn't it also work with FreeRadius?
I find those sorts of statements/questions particularly irritating. FreeRADIUS is running on a different machine to NPS, maybe a different network? There are many other variables that change, not just the RADIUS server. Investigate the issue yourself. If you find something that points to the issue being with FreeRADIUS, post it to the list, we'll tell you if your suspicions were correct or not. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi Arran, Sorry for the previous question, but your reply said the problem was with my access controller and you recommended I replace it. I assumed you meant there is something wrong with it. The NPS and FreeRadius are on the same network. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mshami=tagorg.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Tuesday, April 21, 2015 4:28 PM To: FreeRadius users mailing list Subject: Re: 802.1x with Cisco wireless controller
On 21 Apr 2015, at 14:15, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
Thanks a million for your reply.
But I can't help but be surprised that the access controller is working well with the MS radius server. Since it doesn't, shouldn't it also work with FreeRadius?
I find those sorts of statements/questions particularly irritating. FreeRADIUS is running on a different machine to NPS, maybe a different network? There are many other variables that change, not just the RADIUS server. Investigate the issue yourself. If you find something that points to the issue being with FreeRADIUS, post it to the list, we'll tell you if your suspicions were correct or not. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 21 Apr 2015, at 14:53, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
Hi Arran,
Sorry for the previous question, but your reply said the problem was with my access controller and you recommended I replace it.
There have been enough issues with Cisco wireless controllers and RADIUS that Alan's response wasn't unjustified.
I assumed you meant there is something wrong with it.
Not sure what you meant there. -Arran (not Alan) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 21/04/15 15:04, Arran Cudbard-Bell wrote:
On 21 Apr 2015, at 14:53, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
Hi Arran,
Sorry for the previous question, but your reply said the problem was with my access controller and you recommended I replace it.
There have been enough issues with Cisco wireless controllers and RADIUS that Alan's response wasn't unjustified.
Honestly, they're no worse or better than any other NAS I've used; most vendor equipment is fairly crappy in one fashion or another. I would bet the OP is running into either radio-side issues e.g. "blacklist bad hosts for X seconds" or connectivity between the NAS and radius server. But the general point is: yes, he must have some sort of local problem, because loads of people use Cisco WLC and FreeRADIUS successfully. There's no special trick - just set it up right and it goes.
On Tue, Apr 21, 2015 at 01:15:40PM +0000, Mohammad H. Al Shami wrote:
But I can't help but be surprised that the access controller is working well with the MS radius server. Since it doesn't, shouldn't it also work with FreeRadius?
We have a mix of Cisco controller models, including the 2504, and have no problems using them with FreeRADIUS. So it does work. Currently on WLC software 8.0.110.0, previously on older 8.x and 7.x releases. Can be 16,000 or more clients per day. But no idea in your case what's broken - either you've got a different configuration in some way, or you're looking at your logs harder than we are and caring about something that we aren't! Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Matthew, My access controller is running version 7.3.101.0. Can you share your configuration files or at least point me to a place where I can look? My setup works once then fails for some time, works once then fails for even more time. Clients can't join the wireless network so it's not an issue if me looking at the log. Thanks in advance -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mshami=tagorg.com@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Tuesday, April 21, 2015 4:30 PM To: FreeRadius users mailing list Subject: Re: 802.1x with Cisco wireless controller On Tue, Apr 21, 2015 at 01:15:40PM +0000, Mohammad H. Al Shami wrote:
But I can't help but be surprised that the access controller is working well with the MS radius server. Since it doesn't, shouldn't it also work with FreeRadius?
We have a mix of Cisco controller models, including the 2504, and have no problems using them with FreeRADIUS. So it does work. Currently on WLC software 8.0.110.0, previously on older 8.x and 7.x releases. Can be 16,000 or more clients per day. But no idea in your case what's broken - either you've got a different configuration in some way, or you're looking at your logs harder than we are and caring about something that we aren't! Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 21/04/15 14:46, Mohammad H. Al Shami wrote:
Thanks Matthew,
My access controller is running version 7.3.101.0. Can you share your configuration files or at least point me to a place where I can look? My setup works once then fails for some time, works once then fails for even more time. Clients can't join the wireless network so it's not an issue if me looking at the log.
You're not being clear here. We use Cisco WLC. There's no special magic - just set them up according to the docs and they'll do radius auth. I'm not sure what: """ Clients can't join the wireless network so it's not an issue if me looking at the log. """ ...means. I suggest you blow away your WLC and radius configs and start from scratch. Start simple - put a single controller and radius server on the same subnet, configure basic WPA-Enterprise on the controller, start with the FreeRADIUS default configs and a single test user, work from there. Make small changes at each step, and check the configs into version control after each change is working.
Thanks for your suggestion Phil, That's exactly what I did. I started from a fresh FreeRadius setup and reconfigured the controller from scratch. I back up every working step and when I fix something, I revert to the previous copy and make only the required changes, and back up again. I have an OpenWRT router authenticating against my FreeRadius server with no issues what so ever. When trying to connect using the Cisco access controller 9 times out of 10 I get a "Can't connect to this network" error. With OpenWRT, it's working 100%. I tried different configurations on the wireless controller with no luck. I followed the documentation, used the same options as the working SSID which uses the NPS, even tried toggling one option at a time. Both the WLC and the radius server are on the same subnet. I would really appreciate it if you could share your configuration so I can check. Thanks again -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mshami=tagorg.com@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, April 21, 2015 5:17 PM To: freeradius-users@lists.freeradius.org Subject: Re: 802.1x with Cisco wireless controller On 21/04/15 14:46, Mohammad H. Al Shami wrote:
Thanks Matthew,
My access controller is running version 7.3.101.0. Can you share your configuration files or at least point me to a place where I can look? My setup works once then fails for some time, works once then fails for even more time. Clients can't join the wireless network so it's not an issue if me looking at the log.
You're not being clear here. We use Cisco WLC. There's no special magic - just set them up according to the docs and they'll do radius auth. I'm not sure what: """ Clients can't join the wireless network so it's not an issue if me looking at the log. """ ...means. I suggest you blow away your WLC and radius configs and start from scratch. Start simple - put a single controller and radius server on the same subnet, configure basic WPA-Enterprise on the controller, start with the FreeRADIUS default configs and a single test user, work from there. Make small changes at each step, and check the configs into version control after each change is working. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 21, 2015, at 10:31 AM, Mohammad H. Al Shami <mshami@tagorg.com> wrote:
That's exactly what I did. I started from a fresh FreeRadius setup and reconfigured the controller from scratch. I back up every working step and when I fix something, I revert to the previous copy and make only the required changes, and back up again. I have an OpenWRT router authenticating against my FreeRadius server with no issues what so ever.
When trying to connect using the Cisco access controller 9 times out of 10 I get a "Can't connect to this network" error. With OpenWRT, it's working 100%.
Try looking at ALL of the traffic. Use a test PC. Compare the traffic PC <-> AP to the traffic AP <-> RADIUS. Is the Access-Challenge getting converted to an EAP packet back to the PC? i.e. Find out WHERE the problem is located. Just poking the AP / RADIUS config won't help. You have to follow each packet through the network, and see exactly where it goes wrong. And which piece of the network goes wrong. Alan DeKok.
A basic standard install of freeradius will work with cisco WLC (after adding the WLC address(es) as clients and adding a user for authentication ) There's no magic here. I'd suggest you look at network connectivity here - eg tcpdump the ethernet interface of the freeradius box on which requests are coming in using source ip of the WLC as filter. Are the requests even reaching the FR box? Also your WLC release is old (and buggy) alan
participants (6)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Matthew Newton -
Mohammad H. Al Shami -
Phil Mayers